Description
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Remediation
References
https://akka.io/security/alpakka-kafka-cve-2023-29471.html
https://github.com/akka/alpakka-kafka/issues/1592
Related Vulnerabilities
CVE-2023-29521 Vulnerability in maven package org.xwiki.platform:xwiki-platform-vfs-ui
CVE-2023-50730 Vulnerability in maven package edu.gemini:gsp-graphql-core_native0.4_3
CVE-2017-2610 Vulnerability in maven package org.jenkins-ci.main:jenkins-war
CVE-2023-46656 Vulnerability in maven package igalg.jenkins.plugins:multibranch-scan-webhook-trigger
CVE-2020-9487 Vulnerability in maven package org.apache.nifi:nifi-web-security